ZyXEL Communications P-660HWP-Dx CHAPTER 11

P-660HWP-Dx User’s Guide 47

CHAPTER 11

Firewall Configuration

This chapter shows you how to enable and configure the P-660HWP-Dx firewall.

11.1 Access Methods

The web configurator is, by far, the most comprehensive firewall configuration tool your P-

660HWP-Dx has to offer. For this reason, it is recommended that you configure your firewall

using the web configurator.CLI (Command Line Interpreter) commands provide limited

configuration options and are only recommended for advanced users.

11.2 Firewall Policies Overview

Firewall rules are grouped based on the direction of travel of packets to which they apply:

By default, the P-660HWP-Dx’s stateful packet inspection allows packets traveling in the

following directions:

• LAN to LAN/ Router

This allows computers on the LAN to manage the P-660HWP-Dx and communicate

between networks or subnets connected to the LAN interface.

• LAN to WAN

By default, the P-660HWP-Dx’s stateful packet inspection drops packets traveling in the

following directions:

•WAN to LAN

•WAN to WAN/ Router

This prevents computers on the WAN from using the P-660HWP-Dx as a gateway to

communicate with other computers on the WAN and/or managing the P-660HWP-Dx.

You may define additional rules and sets or modify existing ones but please exercise

extreme caution in doing so.

• LAN to LAN/ Router • WAN to LAN

• LAN to WAN • WAN to WAN/ Router

Contents

Main Page About This User's Guide " Document Conventions 1 " Page Safety Warnings 1 Page Page Contents Overview Page Table of Contents Page Page Page Page Page Page Part VI: Maintenance and Troubleshooting....................................... 263 Part VII: Appendices and Index .......................................................... 303 Page List of Figures Page Page Page Page Page List of Tables Page Page Page Page Page Page Page CHAPTER 1 Introducing the P-660HWP-Dx 1.1 Overview 1 H " 1.2 Ways to Manage the P-660HWP-Dx 1.3 Good Habits for Managing the P-660HWP-Dx 1.4 LEDs Chapter 1 Introducing the P-660HWP-Dx 1.5 Hardware Connections Refer to the Quick Start Guide for information on hardware connections. Table 2 Front Panel LEDs 1.5.1 Connecting a POTS Splitter 1.5.2 Telephone Microfilters 1.5.3 P-660HWP-Dx With ISDN Page Page CHAPTER 2 Introducing the Web Configurator 2.1 Web Configurator Overview 2.2 Accessing the Web Configurator " 2.2.1 User Access 2.2.2 Administrator Access Page 2.3 Resetting the P-660HWP-Dx 2.3.1 Using the Reset Button 2.4 Navigating the Web Configurator 2.4.1 Navigation Panel Chapter 2 Introducing the Web Configurator " embedded help. Table 3 Web Configurator Screens Summary Table 3 Web Configurator Screens Summary (continued) Chapter 2 Introducing the Web Configurator 2.4.2 Status Screen Figure 13 Status Screen Table 3 Web Configurator Screens Summary (continued) The following table describes the labels shown in the Status screen. Table 4 Status Screen Chapter 2 Introducing the Web Configurator 2.4.3 Status: Any IP Table Figure 14 Status: Any IP Table Table 4 Status Screen (continued) 2.4.4 Status: WLAN Status 2.4.5 Status: Bandwidth Status Page Figure 18 Status: Packet Statistics Table 7 Status: Packet Statistics 2.4.8 Changing Login Password Page Page Page CHAPTER 3 Wizard Setup for Internet/ Wireless Access " Page 3.2.1 Automatic Detection Page Chapter 3 Wizard Setup for Internet/Wireless Access Figure 26 Internet Connection with PPPoE Table 8 Internet Access Wizard Setup: ISP Parameters Page Chapter 3 Wizard Setup for Internet/Wireless Access Figure 28 Internet Connection with ENET ENCAP Table 11 Internet Connection with ENET ENCAP Page Page Page Chapter 3 Wizard Setup for Internet/Wireless Access Figure 34 Wireless LAN Setup Wizard 2 Table 14 Wireless LAN Setup Wizard 2 " 3.3.1 Manually assign a WPA-PSK key 3.3.2 Manually assign a WEP key Page Page CHAPTER 4 Bandwidth Management Wizard 4.1 Introduction 4.2 Predefined Media Bandwidth Management Services Chapter 4 Bandwidth Management Wizard 4.3 Bandwidth Management Wizard Setup Figure 39 Select a Mode Table 17 Media Bandwidth Management Setup: Services (continued) Page Chapter 4 Bandwidth Management Wizard Figure 42 Bandwidth Management Wizard: Configuration Table 19 Bandwidth Management Wizard: Configuration Page Page Page Page CHAPTER 5 WAN Setup 5.1 WAN Overview 5.1.1 Encapsulation 5.1.2 Multiplexing 5.1.3 Encapsulation and Multiplexing Scenarios 5.1.4 VPI and VCI 5.1.5 IP Address Assignment 5.1.6 Nailed-Up Connection (PPP) 5.1.7 NAT 5.2 Metric 5.3 Traffic Shaping 5.3.1 ATM Traffic Classes 5.4 Zero Configuration Internet Access 5.5 Internet Connection Chapter 5 WAN Setup Figure 45 Internet Connection (PPPoE) Table 20 Internet Connection 5.5.1 Configuring Advanced Internet Connection Setup Table 20 Internet Connection (continued) Chapter 5 WAN Setup Figure 46 Advanced Internet Connection Setup Table 21 Advanced Internet Connection Setup 5.6 Configuring More Connections Figure 47 More Connections Table 21 Advanced Internet Connection Setup (continued) Chapter 5 WAN Setup 5.6.1 More Connections Edit Click the edit icon ( ) in the More Connections screen to configure a connection. Table 22 More Connections Page Chapter 5 WAN Setup Table 23 More Connections Edit (continued) 5.6.2 Configuring More Connections Advanced Setup Figure 49 More Connections Advanced Setup The following table describes the labels in this screen. Table 24 More Connections Advanced Setup Page Figure 52 WAN Backup Setup The following table describes the labels in this screen. Table 25 WAN Backup Setup Chapter 5 WAN Setup Note: If you activate traffic redirect, you must configure at least one Check WAN IP Address. Table 25 WAN Backup Setup (continued) Page CHAPTER 6 LAN Setup 6.1 LAN Overview 6.1.1 6.1.2 DHCP Setup 6.1.3 DNS Server Address 6.1.4 DNS Server Address Assignment 6.2 LAN TCP/IP 6.2.1 IP Address and Subnet Mask " 6.2.2 RIP Setup 6.2.3 Multicast 6.2.4 Any IP " 6.3 Configuring LAN IP The following table describes the fields in this screen. 6.3.1 Configuring Advanced LAN Setup The following table describes the labels in this screen. 6.4 DHCP Setup Figure 57 DHCP Setup Table 27 Advanced LAN Setup (continued) Chapter 6 LAN Setup 6.5 LAN Client List Table 28 DHCP Setup Figure 58 LAN Client List 6.6 LAN IP Alias Table 29 LAN Client List " Table 30 LAN IP Alias CHAPTER 7 Wireless LAN 7.1 Wireless Network Overview 7.2 Wireless Network Setup 7.2.1 Requirements 7.2.2 Setup Information 7.3 Wireless Security Overview 7.3.1 SSID 7.3.2 MAC Address Filter 7.3.3 User Authentication 7.3.4 Encryption " 7.3.5 One-Touch Intelligent Security Technology (OTIST) 7.4 General Wireless LAN Screen " 7.4.1 No Security " 7.4.2 WEP Encryption Figure 64 Wireless: Static WEP Encryption 7.4.3 WPA-PSK/WPA2-PSK Table 34 Wireless: Static WEP Encryption Chapter 7 Wireless LAN Figure 65 Wireless: WPA-PSK/WPA2-PSK Table 35 Wireless: WPA-PSK/WPA2-PSK 7.4.4 WPA/WPA2 Chapter 7 Wireless LAN Table 36 Wireless: WPA/WPA2 7.4.5 Wireless LAN Advanced Setup Figure 67 Advanced The following table describes the labels in this screen. Table 37 Wireless LAN: Advanced 7.5 OTIST " 7.5.1 Enabling OTIST " 7.5.2 Starting OTIST " 7.5.3 Notes on OTIST 7.6 MAC Filter 7.7 WMM QoS 7.7.1 WMM QoS Example 7.7.2 WMM QoS Priorities 7.7.3 Services Table 41 Commonly Used Services Chapter 7 Wireless LAN P-660HWP-Dx Users Guide 55 7.8 QoS Screen 7.8.1 ToS (Type of Service) and WMM QoS Table 41 Commonly Used Services (continued) Click Network > Wireless LAN > QoS. The following screen displays. Figure 76 Wireless LAN: QoS Table 42 Wireless Lan: QoS Chapter 7 Wireless LAN P-660HWP-Dx Users Guide 57 7.8.2 Application Priority Configuration Figure 77 Application Priority Configuration Table 43 Application Priority Configuration Page CHAPTER 8 Powerline 8.1 Overview 8.2 Privacy and Powerline Adapters " 8.2.1 Setting Up a Private Powerline Network AB 8.2.2 Setting Up Multiple Powerline Networks. 8.3 Configuring Local Settings Figure 81 Network > Powerline > Local Setting Table 44 Network > Powerline > Local Setting 8.4 Configuring Remote Settings 8.5 Powerline Network Status Table 46 Network > Powerline > Status Figure 83 Network > Powerline > Status Page Page CHAPTER 9 Network Address Translation (NAT) 9.1 NAT Overview 9.1.1 NAT Definitions 9.1.2 What NAT Does 9.1.3 How NAT Works 9.1.4 NAT Application 9.1.5 NAT Mapping Types 9.2 SUA (Single User Account) Versus NAT 9.3 SIP ALG Chapter 9 Network Address Translation (NAT) 9.4 NAT General Setup Figure 86 NAT General The following table describes the labels in this screen. Table 49 NAT General 9.5 Port Forwarding " 9.5.2 Port Forwarding: Services and Port Numbers 9.5.3 Configuring Servers Behind Port Forwarding (Example) 9.6 Configuring Port Forwarding " Figure 88 NAT Port Forwarding The following table describes the fields in this screen. 9.6.1 Port Forwarding Rule Edit Table 51 NAT Port Forwarding 9.7 Address Mapping " Page Chapter 9 Network Address Translation (NAT) 9.7.1 Address Mapping Rule Edit Figure 91 Edit Address Mapping Rule The following table describes the fields in this screen. Table 54 Edit Address Mapping Rule Page Page Page CHAPTER 10 Firewalls 10.1 Firewall Overview 10.2 Types of Firewalls 10.2.1 Packet Filtering Firewalls 10.3 Introduction to ZyXELs Firewall 10.3.1 Denial of Service Attacks 10.4 Denial of Service 10.4.1 Basics 10.4.2 Types of DoS Attacks Page 10.5 Stateful Inspection 10.5.1 Stateful Inspection Process 10.5.2 Stateful Inspection and the P-660HWP-Dx " 10.5.3 TCP Security 10.5.4 UDP/ICMP Security 10.5.5 Upper Layer Protocols 10.6 Guidelines for Enhancing Security with Your Firewall 10.6.1 Security In General 10.7 Packet Filtering Vs Firewall 10.7.1 Packet Filtering: 10.7.2 Firewall Page CHAPTER 11 Firewall Configuration 11.1 Access Methods 11.2 Firewall Policies Overview " 11.3 Rule Logic Overview " 11.3.1 Rule Checklist 11.3.2 Security Ramifications 11.3.3 Key Fields For Configuring Rules " 11.4 Connection Direction 11.4.1 LAN to WAN Rules 11.4.2 Alerts 11.5 General Firewall Policy 11.6 Firewall Rules Summary " Figure 98 Firewall Rules Table 60 Firewall Rules Chapter 11 Firewall Configuration P-660HWP-Dx Users Guide 53 11.6.1 Configuring Firewall Rules Table 60 Firewall Rules (continued) Page Chapter 11 Firewall Configuration P-660HWP-Dx Users Guide 55 Table 61 Firewall: Edit Rule 11.6.2 Customized Services 11.6.3 Configuring a Customized Service 11.7 Example Firewall Rule Page Page Page 11.8 Predefined Services Table 64 Predefined Services (continued) 11.9 Anti-Probing 64 11.10 DoS Thresholds 11.10.1 Threshold Values 11.10.2 Half-Open Sessions 11.10.3 Configuring Firewall Thresholds Figure 108 Firewall: Threshold Table 66 Firewall: Threshold Chapter 11 Firewall Configuration P-660HWP-Dx Users Guide 67 Table 66 Firewall: Threshold (continued) Page CHAPTER 12 Content Filtering 12.1 Content Filtering Overview 12.2 Configuring Keyword Blocking Chapter 12 Content Filtering 70 The following table describes the labels in this screen. Figure 110 Content Filter: Schedule 12.3 Configuring the Schedule Table 67 Content Filter: Keyword 12.4 Configuring Trusted Computers The following table describes the labels in this screen. Figure 111 Content Filter: Trusted Table 68 Content Filter: Schedule Table 69 Content Filter: Trusted Page CHAPTER 13 Certificates 13.1 Certificates Overview 13.1.1 Advantages of Certificates 13.2 Self-signed Certificates 13.3 Verifying a Certificate 13.3.1 Checking the Fingerprint of a Certificate on Your Computer 13.4 Configuration Summary 13.5 My Certificates Figure 115 Security > Certificates > My Certificates The following table describes the labels in this screen. Table 70 Security > Certificates > My Certificates Chapter 13 Certificates 13.6 My Certificates > Details Table 70 Security > Certificates > My Certificates (continued) Table 71 Security > Certificates > My Certificates > Edit Table 72 Security > Certificates > My Certificates > Details Chapter 13 Certificates Table 72 Security > Certificates > My Certificates > Details (continued) 13.7 My Certificates > Create Chapter 13 Certificates Table 73 Security > Certificates > My Certificates > Create 13.8 My Certificates > Import 13.8.1 Certificate File Formats " 13.9 Trusted CAs Figure 118 Security > Certificates > Trusted CAs The following table describes the labels in this screen. Table 75 Security > Certificates > Trusted CAs 13.10 Trusted CA Details Table 76 Security > Certificates > Trusted CAs > Details Chapter 13 Certificates 13.11 Trusted CA > Import import the certificate. " Table 76 Security > Certificates > Trusted CAs > Details (continued) 13.12 Trusted Remote Hosts Chapter 13 Certificates The following table describes the labels in this screen. 13.13 Trusted Remote Hosts > Import Table 78 Security > Certificates > Trusted Remote Hosts " 13.14 Trusted Remote Host Certificate Details Chapter 13 Certificates P-660HWP-Dx Users Guide 53 Figure 123 Security > Certificates > Trusted Remote Hosts > Details Table 80 Security > Certificates > Trusted Remote Hosts > Details Table 80 Security > Certificates > Trusted Remote Hosts > Details (continued) 13.15 Directory Servers 13.16 Directory Server Add or Edit Figure 125 Security > Certificates > Directory Server > Add Table 82 Security > Certificates > Directory Server > Add Page Page CHAPTER 14 Static Route The following table describes the labels in this screen. 14.2.1 Static Route Edit Chapter 14 Static Route Figure 128 Static Route Edit Table 84 Static Route Edit Page CHAPTER 15 Bandwidth Management 15.1 Bandwidth Management Overview 15.2 Application-based Bandwidth Management 15.3 Subnet-based Bandwidth Management 15.4 Application and Subnet-based Bandwidth Management 15.5 Scheduler 15.5.1 Priority-based Scheduler 15.5.2 Fairness-based Scheduler 15.6 Maximize Bandwidth Usage 15.6.1 Reserving Bandwidth for Non-Bandwidth Class Traffic 15.6.2 Maximize Bandwidth Usage Example 15.6.3 Bandwidth Management Priorities 15.7 Over Allotment of Bandwidth 15.8 Configuring Summary Chapter 15 Bandwidth Management 15.9 Bandwidth Management Rule Setup The following table describes the labels in this screen. Figure 131 Bandwidth Management: Rule Setup Table 91 Media Bandwidth Management: Summary (continued) Table 92 Bandwidth Management: Rule Setup 15.10 DiffServ 15.10.1 DSCP and Per-Hop Behavior 15.10.2 Rule Configuration Table 94 Bandwidth Management Rule Configuration Chapter 15 Bandwidth Management Table 95 Services and Port Numbers Table 94 Bandwidth Management Rule Configuration (continued) 15.11 Bandwidth Monitor CHAPTER 16 Dynamic DNS Setup 16.1 Dynamic DNS Overview 16.1.1 DYNDNS Wildcard 16.2 Configuring Dynamic DNS Chapter 16 Dynamic DNS Setup Figure 135 Dynamic DNS Table 97 Dynamic DNS Chapter 16 Dynamic DNS Setup Table 97 Dynamic DNS (continued) Page CHAPTER 17 Remote Management Configuration 17.1 Remote Management Overview " 17.1.1 Remote Management Limitations 17.2 WWW Chapter 17 Remote Management Configuration 17.3 Telnet Figure 137 Telnet Configuration on a TCP/IP Network Table 98 Remote Management: WWW 17.4 Configuring Telnet 17.5 Configuring FTP 17.6 SNMP " 17.6.1 Supported MIBs 17.6.2 SNMP Traps 17.6.3 Configuring SNMP 17.7 Configuring DNS 17.8 Configuring ICMP 17.9 TR-069 Chapter 17 Remote Management Configuration " The following table gives a description of TR-069 commands. Figure 144 Enabling TR-069 Table 105 TR-069 Commands Page CHAPTER 18 Universal Plug-and-Play (UPnP) 18.1 Introducing Universal Plug and Play 18.1.1 How do I know if I'm using UPnP? 18.1.2 NAT Traversal 18.2 UPnP and ZyXEL 18.2.1 Configuring UPnP 18.3 Installing UPnP in Windows Example 18.3.1 Installing UPnP in Windows Me 18.3.2 Installing UPnP in Windows XP Page 18.4.1 Auto-discover Your UPnP-enabled Network Device Page " 18.4.2 Web Configurator Easy Access Page Page Page PART VI Page CHAPTER 19 System 19.1 General Setup 19.1.1 General Setup and System Name 19.1.2 General Setup Figure 160 System General Setup Table 107 System General Setup 19.2 Time Setting Table 108 System Time Setting Chapter 19 System Table 108 System Time Setting (continued) Page CHAPTER 20 Logs 20.1 Logs Overview 20.1.1 Alerts and Logs 20.2 Viewing the Logs 20.3 Configuring Log Settings Page 20.3.1 Example E-mail Log End of Log" message shows that a complete log has been sent. Table 110 Log Settings Chapter 20 Logs Figure 164 E-mail Log Example 20.4 Log Descriptions This section provides descriptions of example log messages. Table 111 System Maintenance Logs Table 112 System Error Logs Table 113 Access Control Logs Table 111 System Maintenance Logs (continued) Chapter 20 Logs Table 114 TCP Reset Logs Table 115 Packet Filter Logs Table 113 Access Control Logs (continued) Table 116 ICMP Logs Table 117 CDR Logs Table 118 PPP Logs Chapter 20 Logs Table 119 UPnP Logs Table 120 Content Filtering Logs Table 121 Attack Logs Table 122 IPSec Logs Chapter 20 Logs Table 123 IKE Logs Table 122 IPSec Logs (continued) Table 123 IKE Logs (continued) Chapter 20 Logs Table 123 IKE Logs (continued) Table 124 PKI Logs Chapter 20 Logs Table 125 Certificate Path Verification Failure Reason Codes Table 126 ACL Setting Notes Table 127 ICMP Notes Chapter 20 Logs Table 128 Syslog Logs Table 129 RFC-2408 ISAKMP Payload Types Page CHAPTER 21 Tools 21.1 Firmware Upgrade 1 21.2 Configuration Screen 21.2.1 Backup Configuration 21.2.2 Restore Configuration 1 21.2.3 Back to Factory Defaults 21.3 Restart Page CHAPTER 22 Diagnostic 22.1 General Diagnostic Chapter 22 Diagnostic 22.2 DSL Line Diagnostic Click Maintenance > Diagnostic > DSL Line to open the screen shown next. Figure 175 Diagnostic: DSL Line The following table describes the fields in this screen. Table 134 Diagnostic: DSL Line CHAPTER 23 Troubleshooting 23.1 Power, Hardware Connections, and LEDs V 23.2 P-660HWP-Dx Access and Login V 23.3 Internet Access V 23.4 Powerline Issues V Page PART VII Page APPENDIX A Product Specifications and Wall Mounting Product Specifications The following tables summarize the P-660HWP-Dxs hardware and firmware features.M4 Table 135 Hardware Specifications Note: Only upload firmware for your specific model! Appendix A Product Specifications and Wall Mounting Table 137 Wireless Firmware Specifications Table 136 Firmware Specifications Table 138 Standards Supported Wall-mounting Instructions " Page APPENDIX B Wireless LANs Wireless LAN Topologies Ad-hoc Wireless LAN Configuration BSS ESS Channel RTS/CTS " Fragmentation Threshold Preamble Type " IEEE 802.11g Wireless LAN Wireless Security Overview " IEEE 802.1x RADIUS Types of RADIUS Messages Types of EAP Authentication EAP-MD5 (Message-Digest Algorithm 5) EAP-TLS (Transport Layer Security) EAP-TTLS (Tunneled Transport Layer Service) PEAP (Protected EAP) LEAP " WPA and WPA2 Encryption User Authentication Wireless Client WPA Supplicants WPA(2) with RADIUS Application Example WPA(2)-PSK Application Example Security Parameters Summary Antenna Overview Antenna Characteristics Frequency Radiation Pattern Antenna Gain Types of Antennas for WLAN Page APPENDIX C Internal SPTGEN Internal SPTGEN Overview The Configuration Text File Format " Internal SPTGEN File Modification - Important Points to Remember Internal SPTGEN FTP Download Example " be named rom-t when you upload it to your P-660HWP-Dx. Internal SPTGEN FTP Upload Example Example Internal SPTGEN Menus This section provides example Internal SPTGEN menus. Table 143 Abbreviations Used in the Example Internal SPTGEN Screens Table Table 144 Menu 1 General Setup Page Table 146 Menu 4 Internet Access Setup Appendix C Internal SPTGEN Table 146 Menu 4 Internet Access Setup (continued) Table 147 Menu 12 Table 148 Menu 15 SUA Server Setup Appendix C Internal SPTGEN Table 148 Menu 15 SUA Server Setup (continued) Table 149 Menu 21.1 Filter Set #1 Appendix C Internal SPTGEN Table 149 Menu 21.1 Filter Set #1 (continued) Table 150 Menu 21.1 Filter Set #2 Table 150 Menu 21.1 Filter Set #2 (continued) Appendix C Internal SPTGEN Table 150 Menu 21.1 Filter Set #2 (continued) Table 151 Menu 23 System Menus Table 151 Menu 23 System Menus (continued) Table 152 Menu 24.11 Remote Management Control Appendix C Internal SPTGEN Command Examples Table 153 Command Examples Page APPENDIX D Setting up Your Computers IP Address Windows 95/98/Me Installing Components Configuring Windows 2000/NT/XP Page Page Page Page Macintosh OS 8/9 Page Macintosh OS X Linux " Using the K Desktop Environment (KDE) Using Configuration Files Page Enter ifconfig in a terminal screen to check your TCP/IP properties. APPENDIX E IP Subnetting Introduction to IP Addresses IP Address Classes and Hosts Subnet Masks Subnetting Example: Two Subnets " Appendix E IP Subnetting Example: Four Subnets Table 161 Subnet 1 Table 162 Subnet 2 Table 163 Subnet 3 Table 164 Subnet 4 Example Eight Subnets Subnetting With Class A and Class B Networks. Page Page APPENDIX F Command Interpreter 1 Accessing the CLI Command Syntax Log Commands Configuring What You Want the P-660HWP-Dx to Log Displaying Logs Appendix F Command Interpreter Log Command Example Page APPENDIX G Firewall Commands The following describes the firewall commands. Table 168 Firewall Commands Page Page Page Page Page APPENDIX H Pop-up Windows, JavaScripts and Java Permissions " Internet Explorer Pop-up Blockers Disable pop-up Blockers Enable pop-up Blockers with Exceptions Page JavaScripts Page Page APPENDIX I NetBIOS Filter Commands Introduction Display NetBIOS Filter Settings NetBIOS Filter Configuration APPENDIX J Triangle Route The Ideal Setup The Triangle Route Problem Page APPENDIX K Legal Information Copyright Certifications ! ZyXEL Limited Warranty Page APPENDIX L Customer Support Page Page Page Page Page Index A B C D E F H I L M N O P Q R S T U V W Z